fix: repair failing tests and type errors across api and shared packages

[stooit]

Summary

Fixes all 9 failing tests and 14 tsc errors. bun test → 22 pass / 0 fail; bunx tsc --noEmit → exit 0. No test files modified, no dependencies added.

Root causes & fixes

• packages/api/src/middleware/auth.ts — Public-method allow-list held "post" (lowercase). Hono reports c.req.method uppercase, so POST fell through to the token check and returned 401. Fixed to "POST" and normalised the incoming method with .toUpperCase() to prevent casing regressions.
• packages/shared/src/types.ts — Renamed User.userName → username to match the field the (unmodifiable) tests and route code use. Cleared the four TS2561 errors.
• packages/api/src/routes/users.ts — Added missing badRequest import from ../lib/errors; it was referenced but never imported, throwing ReferenceError (500 instead of the expected 400).
• packages/shared/src/utils/pagination.ts — Implemented the paginate stub per the test contract: 1-indexed page, returns { data, page, pageSize, total, totalPages }, empty/out-of-range inputs yield empty data with total/totalPages of 0.
• tsconfig.json — Added "types": ["bun-types"] (already an installed root devDependency) so TypeScript picks up bun:test and process ambient globals. Resolves the 8 remaining tsc errors without adding dependencies.

Assumptions

• Tests are the source of truth: the username field name and the pagination return shape were derived from the assertions in the test files.
• POST endpoints being public is deliberately asserted by auth.test.ts and was preserved.

Notes (out of scope, flagged not changed)

• The auth policy makes POST /users / POST /posts accept unauthenticated writes — pinned by the tests, but a real exposure if it reaches production.
• The token check uses a hardcoded "test-token" fallback and non-constant-time comparison (timing-attack exposure). Pre-existing; left unchanged.
• README.md "Known issues" section is now stale but left untouched (not part of pass criteria).